A method for integrating an optimized network service and a dynamically generated protection scheme

Abstract

The present application provides a method for integrating an optimized network service and a dynamically generated protection scheme, including: obtaining threat intelligence data, determining whether the current network service supports a preset encryption protocol according to the threat intelligence data, if it supports, determining the current network service as a candidate network service, if it does not support, screening other network services; extracting the encryption protocol type and strength parameters of the candidate network service, and determining a target network service in combination with the threat level in the threat intelligence data; generating an encryption key based on the encryption protocol type and strength parameters of the target network service; binding the encryption key to the transmission path to form a protection scheme; monitoring abnormal behaviors during the data transmission process, and if abnormal behaviors are detected, updating the protection scheme.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a method for integrating optimal network services and dynamically generating protection solutions. Background Art

[0002] Network data transmission faces increasingly complex and changeable security threats. Traditional static encryption and fixed routing methods are difficult to cope with this dynamic environment. How to achieve high security and reliability while ensuring data transmission efficiency has become a key challenge. Specifically, there are many potential threats in the network environment, including data eavesdropping, man-in-the-middle attacks, DDoS attacks, etc. The characteristics and means of these threats are constantly evolving. At the same time, the network topology is complex and changeable, and the security levels and encryption capabilities of different nodes are different. In this case, how to accurately identify and evaluate the security threats in the current network environment and select the optimal encryption scheme and transmission path based on this? In addition, even if preliminary security measures are taken, network attackers may still find out the weak links of the system through long-term observation and analysis. Therefore, how to achieve dynamic adjustment and continuous optimization of security policies to cope with the ever-changing attack patterns? These problems involve the integration and innovation of multiple technical fields such as threat intelligence analysis, encryption technology, routing algorithms, and anomaly detection, which constitute a complex technical problem. Solving this problem requires not only considering the advancement of technology, but also taking into account the performance overhead and user experience in actual applications, and finding a balance between security, efficiency and availability. Summary of the invention

[0003] The present invention provides a method for integrating optimal network services and dynamically generating protection solutions, which mainly includes:

[0004] Acquire threat intelligence data, and determine whether the current network service supports a preset encryption protocol based on the threat intelligence data; if so, determine the current network service as a candidate network service; if not, screen other network services; extract the encryption protocol type and strength parameters of the candidate network service, and determine the target network service in combination with the threat level in the threat intelligence data; generate an encryption key based on the encryption protocol type and strength parameters of the target network service; bind the encryption key to the transmission path to form a protection plan; monitor abnormal behavior during data transmission, and update the protection plan if abnormal behavior is detected.

[0005] Further, the obtaining of threat intelligence data and determining whether the current network service supports a preset encryption protocol based on the threat intelligence data includes: obtaining multi-source threat intelligence data through an interface, integrating and cleaning the multi-source threat intelligence data to form a threat intelligence report in a unified format; parsing the threat intelligence report to extract network service information, where the network service information at least includes the address, port, and protocol type of the network service; comparing the network service information with a preset encryption protocol list to determine whether the current network service supports the encryption protocols in the preset encryption protocol list. If the current network service supports at least one encryption protocol in the preset encryption protocol list, it is determined that the current network service supports the preset encryption protocol; otherwise, it is determined that the current network service does not support the preset encryption protocol.

[0006] Further, the extracting of the encryption protocol type and strength parameters of the candidate network service and determining the target network service in combination with the threat level in the threat intelligence data includes: traversing the candidate network service list, and for each candidate network service, extracting the encryption protocol type supported by the candidate network service and the strength parameter corresponding to each encryption protocol; extracting threat level information from the threat intelligence data, and mapping the threat level information to a numerical threat level score according to a preset threat level classification standard; constructing a network service security evaluation model based on the encryption protocol type and strength parameter, and using a preset evaluation algorithm to calculate the security score of each candidate network service; combining the threat level score and the security score, and using a weighted calculation method to obtain the comprehensive security score of each candidate network service, and selecting the candidate network service with the highest comprehensive security score as the target network service.

[0007] Further, the generating of an encryption key based on the encryption protocol type and strength parameter of the target network service includes: selecting a corresponding key generation algorithm according to the encryption protocol type of the target network service. If the encryption protocol type is symmetric encryption, select the first key generation algorithm; if the encryption protocol type is asymmetric encryption, select the second key generation algorithm; determining the key length according to the encryption protocol strength parameter of the target network service, where the key length is positively correlated with the encryption protocol strength parameter; generating an initial random number through a hardware random number generator, and generating an initial key based on the initial random number and the key generation algorithm; performing a complexity detection on the initial key to determine whether the initial key meets the preset complexity requirement. If it does not meet the requirement, regenerate the initial key until the generated initial key meets the complexity requirement, and use the initial key that meets the complexity requirement as the encryption key.

[0008] Further, binding the encryption key to the transmission path to form a protection scheme includes: obtaining network topology information, constructing a network transmission path model according to the network topology information, where the network transmission path model includes multiple network nodes and links connecting the network nodes; associating the encryption key with the network nodes and links in the network transmission path model to form a key-path mapping relationship; according to different data transmission requests, selecting a corresponding transmission path from the network transmission path model, and assigning the encryption key to the network nodes and links on the transmission path; combining the encryption key, the transmission path, and the corresponding security configuration information into a protection scheme, and storing the protection scheme in the configuration database.

[0009] Further, monitoring abnormal behaviors during data transmission and updating the protection scheme if abnormal behaviors are detected includes: obtaining data packets during data transmission through the method of bypass listening, parsing the data packets, and extracting data packet feature information; comparing the data packet feature information with a preset abnormal behavior feature library to determine whether there are abnormal behaviors. If at least one data packet feature information matches the features in the abnormal behavior feature library, it is determined that there are abnormal behaviors; when abnormal behaviors are detected, triggering a protection scheme update mechanism, and according to the type and level of the abnormal behaviors, selecting a new protection scheme from the protection scheme library; sending the new protection scheme to the network device to replace the original protection scheme.

[0010] Further, selecting a new protection scheme from the protection scheme library according to the type and level of the abnormal behaviors includes: determining the urgency of the protection scheme update according to the type and level of the abnormal behaviors; if the level of the abnormal behavior is a high-risk level, selecting the protection scheme with the fastest update speed; if the level of the abnormal behavior is a medium-risk level, balancing between the update speed and security, and selecting a protection scheme with a relatively fast update speed and high security; if the level of the abnormal behavior is a low-risk level, selecting the protection scheme with the highest security. When updating the protection scheme, according to the type of the abnormal behavior, selecting a protection scheme with a specific protection effect for this type of abnormal behavior. After updating the protection scheme, verifying the new protection scheme to ensure that it can protect against the detected abnormal behaviors.

[0011] The technical solutions provided by the embodiments of the present invention may include the following beneficial effects:

[0012] The present invention discloses a method for integrating optimized network services and dynamically generating protection schemes. This method analyzes network security threat intelligence, evaluates the encryption capabilities of network services, selects the optimal service, and generates complex encryption keys. Combining with the network topology structure, it establishes the mapping relationship between the keys and the transmission paths to achieve dynamic encryption and routing selection of data transmission. The present invention also includes real-time monitoring of transmission behaviors, comparing abnormal features, and automatically updating the protection scheme according to the type and severity of the anomalies. When continuous anomalies are detected, the present invention will re-obtain threat intelligence and generate a new dynamic protection scheme, thereby continuously optimizing data security protection measures. This method significantly improves the security and reliability of network data transmission by integrating threat analysis, dynamic encryption, intelligent routing, and adaptive protection, and effectively responds to the ever-changing network security threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 It is a flowchart of a method for integrating optimized network services and dynamically generating protection schemes according to the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0014] Next, the technical solutions of the present invention will be clearly and completely described in conjunction with the embodiments. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0015] As Figure 1 , a method for integrating optimized network services and dynamically generating protection schemes in this embodiment may specifically include:

[0016] S1011. Obtain the network security threat intelligence analysis report, and judge whether the current network service supports the advanced encryption protocol according to the report. If it supports, add the service to the candidate service list; if not, eliminate it.

[0017] Obtain the threat intelligence analysis report, extract the network service related information, and determine whether each network service supports advanced encryption protocols. If the network service supports advanced encryption protocols, add the service to the candidate service list; if not, remove it from the candidate list. Based on the candidate service list, use the machine learning algorithm to evaluate and score the security of the service to obtain a service security score list. From the service security score list, select the top N network services with the highest scores as candidate services. Conduct in-depth analysis of the candidate services, extract the detailed configuration parameters of the services, and use the expert rule base to determine whether the security configurations of the services meet the standards. According to the security configuration analysis results, combined with the business importance of the service, a comprehensive security score for each candidate service is obtained through weighted calculation. Select the service with the highest comprehensive security score as the final target service, and generate a security reinforcement plan and configuration recommendations for the service. For the target service, extract its encryption protocol type and strength parameters, and determine the optimal encryption scheme through risk matrix calculation based on the threat level in the threat intelligence analysis report. Use the preset encryption algorithm model to dynamically generate new encryption keys based on the parameters of the optimal encryption scheme, and ensure the uniqueness and complexity of the key through key strength assessment. The generated encryption key is applied to the target service, and the confidentiality, integrity and availability of the service are verified through security testing, a network service security assessment report is formed, and the security reinforcement of the service is completed.

[0018] Specifically, first, 10 network services are extracted from the threat intelligence analysis report. After judgment, it is found that 6 of them support advanced encryption protocols such as TLS 1.3, and they are added to the candidate list. Then, the random forest algorithm is used to evaluate the security of the candidate services. Considering factors such as the number of vulnerabilities and the risk level, the services A, B, and C with the top 3 security scores are obtained. Next, the detailed configurations of services A, B, and C, such as key length and encryption algorithm, are extracted, and the expert rule base is used to judge whether they meet the FIPS 140-2 Level 3 standard. The results show that A and C meet the standard, while B does not. Combining the business importance of the services, a weight of 0.6 is assigned to the security configuration score, and a weight of 0.4 is assigned to the business importance. The comprehensive score of service A is calculated to be the highest, which is 0.85. Therefore, service A is selected as the final target, and security reinforcement suggestions are given, such as using AES-256 and 4096-bit RSA keys. Further analysis reveals that service A uses the TLS 1.3 protocol and the key strength is 256 bits. Combining the high-risk level in the threat intelligence, the parameter combination of AES-256, SHA-384, DH-4096, etc. is determined as the optimal encryption scheme through the risk matrix. Finally, a 48-byte random key is generated using the openssl rand -base64 48 command, and its strength is evaluated through the NIST SP 800-22 test suite to ensure the security of the key. This key is applied to service A, and penetration testing is performed on it. No security vulnerabilities are found, proving that the service security meets the requirements.

[0019] S1012. For the network services in the candidate service list, extract their encryption protocol types and strength parameters, and combine the threat levels in the threat intelligence analysis report to determine the optimal network service using a preset network service security evaluation model.

[0020] Obtain a list of candidate network services that support advanced encryption protocols, and extract the type of encryption protocol used by each network service and its corresponding encryption strength parameters. Extract the known threat information related to the candidate network services from the threat intelligence analysis report, and judge the harm level of each threat. Based on the type of encryption protocol and strength parameters, establish a network service security evaluation model, and use the fuzzy comprehensive evaluation method to calculate the security score of each network service. Perform a weighted calculation of the security score of the network service and its corresponding threat level to obtain a ranking of network services that comprehensively considers security and threat risks. Select the network services with higher rankings and that meet the business requirements as the preferred solutions. Before finalizing the solutions, it is also necessary to evaluate the technical feasibility of the selected network services. Conduct penetration testing on the network services involved in the preferred solutions to comprehensively evaluate their ability to resist network attacks. If the test results are not satisfactory, a security reinforcement plan needs to be formulated. Continuously monitor the security status of the selected network services, track the latest threat intelligence, and regularly review the security evaluation model to ensure the long-term effectiveness of the preferred solutions. If new security risks are found in the selected network services during the monitoring process, repeat steps 2-7 until the optimal network service that meets the security requirements is found. According to the finally determined optimal network service, extract its encryption protocol type and strength parameters as the input conditions for subsequent dynamic generation of encryption keys.

[0021] Specifically, first extract the type of encryption protocol of each service from the candidate network service list, such as TLS1.2, TLS 1.3, etc., and the corresponding encryption strength parameters, such as the key length is 128 bits, 256 bits, etc. Then identify the known threats related to the candidate network services from the threat intelligence analysis report, and classify the threat levels into high, medium, and low levels according to factors such as the potential impact range of the threat and the attack success rate. Next, establish a network service security evaluation model, comprehensively consider factors such as the security of the encryption protocol type and the cracking difficulty of the key length, and use the fuzzy comprehensive evaluation method to calculate the security score of each network service, with the score range from 0 to 100 points. Then perform a weighted calculation of the security score and the threat level, where the weight of the security score is 0.6 and the weight of the threat level is 0.4, to obtain a comprehensive score ranking. Select the network service with the highest comprehensive score and that meets the business requirements as the preferred solution, and evaluate its ability to resist network attacks through penetration testing, etc. If security risks are found during the test, formulate corresponding security reinforcement plans, such as upgrading the encryption protocol version, increasing the key length, etc. During subsequent operations, continuously monitor the security status of the selected network services, track the latest threat intelligence, and regularly review the security evaluation model based on the monitoring data to dynamically adjust relevant parameters to ensure that the preferred solution can maintain a high level of security in the long term. Finally, extract the encryption protocol type and strength parameters of the preferred network service, such as using the TLS 1.3 protocol and the key length is 256 bits, as the input conditions for subsequent dynamic generation of encryption keys.

[0022] S1013. Adopt a preset encryption algorithm model. Based on the encryption protocol type and strength parameters of the optimal network service, generate a random string of a specified length as the initial encryption key through a random number generator, and perform a complexity judgment on it until an encryption key that meets the preset complexity requirements is generated.

[0023] According to the threat intelligence analysis report, judge whether the current network service supports an advanced encryption protocol. If it supports, extract its encryption protocol type and strength parameters. If it does not support, filter other network services. Combine the threat level in the threat intelligence analysis report to determine the optimal network service, and obtain its encryption protocol type and strength parameters. Adopt a preset encryption algorithm model. If the encryption protocol type is symmetric encryption, adopt the AES algorithm. If it is asymmetric encryption, adopt the RSA algorithm. For the strength parameters of the encryption protocol, determine the length of the encryption key. Generate a random string of a specified length through a random number generator as the initial encryption key. Perform a complexity judgment on the initial encryption key, and determine whether it meets the complexity requirements according to the preset complexity threshold. If the complexity does not meet the requirements, return to step 5 to regenerate the initial encryption key until the complexity requirements are met. Use the encryption key that meets the complexity requirements as the final dynamic encryption key for data encryption transmission. Bind the generated encryption key to the transmission path to form a new protection scheme, and update it to the network service configuration in real time.

[0024] Specifically, judge the support situation of the encryption protocol of the network service according to the threat intelligence analysis report. If it supports an advanced encryption protocol such as TLS 1.3, extract its encryption protocol type (such as AES, RSA, etc.) and strength parameters (such as key length 128 bits, 256 bits, etc.). Combine the threat level in the threat intelligence (such as high, medium, low), and determine the optimal network service through a comprehensive scoring model, such as the HTTPS service with the highest score. For the encryption protocol type of this service, if it is symmetric encryption, adopt the AES algorithm. If it is asymmetric encryption, adopt the RSA algorithm. Determine the key length according to the protocol strength parameters, such as 128 bits, 256 bits, etc. Use a secure random number generator to generate a random string consisting of letters, numbers, and special characters of a specified length as the initial key. Calculate the information entropy of the key through a key complexity evaluation function, and judge whether it meets the preset complexity threshold (such as 3.5). If it does not meet the requirements, return to regenerate until the requirements are met. Use the key that meets the complexity as the final dynamic encryption key, and bind it to the data transmission path (such as source IP, destination IP, port, etc.) to form a new data protection scheme. Update this scheme to the network service configuration in real time, such as dynamically negotiating and using it in the TLS handshake stage.

[0025] S1014. Obtain the topological structure and node information of the network transmission path, construct a transmission path model according to the logical relationship between nodes and the physical link status, and bind the encryption key to the transmission path model to form a key-path mapping relationship table.

[0026] Obtain the topological structure and node information of the network transmission path, and construct a transmission path model according to the logical relationship between nodes and the physical link status. If the logical relationship between nodes is a master-slave relationship, set the master-slave attribute in the model; if the physical link status is interrupted, mark the interruption status in the model. Calculate the security score of each transmission path according to the node attributes and link status in the transmission path model. Use the weighted average algorithm to assign weights to indicators such as node credibility and link stability to obtain a comprehensive security score. Bind the encryption key to the transmission path model to form a key-path mapping relationship table. Use the start node and end node of the transmission path as indexes to store the corresponding encryption key and construct the mapping relationship. Query the corresponding encryption key and the optimal transmission path in the key-path mapping relationship table according to the source node and target node of the data transmission request. If the query result is empty, regenerate the key and construct a new mapping relationship. During the data transmission process, monitor the network link quality and node status in real time. Use the heartbeat mechanism and anomaly detection algorithm to judge link interruptions and node failures. If a decrease in link quality or abnormal node status is detected, trigger the path switching mechanism. According to the key-path mapping relationship table, select the backup optimal transmission path and update the routing configuration. Dynamically adjust the key update period and path optimization strategy according to network environment changes and attack threat situations. Use machine learning algorithms to obtain the optimal parameter combination through historical data training to achieve adaptive optimization. Synchronize the updated key-path mapping relationship to the network service configuration center and distribute it to each node. Through the configuration management interface, update the routing table and encryption key of the node in real time. Continuously monitor the security and efficiency of data transmission, collect network status data and exception logs as optimization inputs. Through big data analysis and visualization technologies, achieve network security situation awareness and early warning, and continuously improve the overall protection level.

[0027] Specifically, when obtaining the network topology, the neighbor table and link status information of network devices can be queried through the SNMP protocol to construct a network topology graph containing 1000 nodes and 2500 links. According to the routing calculation results of OSPF, the master-slave relationship between nodes and the link interruption status are judged and marked in the model. Then, the weighted average algorithm is used to calculate the security score of the transmission path, with the node credibility weight set to 0.6 and the link stability weight set to 0.4 to obtain the comprehensive score of each path. Next, the 128-bit AES encryption key is bound to the optimal transmission path, and the key-path mapping relationship is stored in the hash table with the source IP address and the destination IP address as indexes. During data transmission, the encryption key and the routing path are quickly obtained by looking up the table. During the transmission process, a heartbeat packet is sent every 10 ms, and the link interruption is judged through the timeout retransmission mechanism; key metrics such as the node CPU and memory are collected every 1 s, and the node failure is judged through the anomaly detection algorithm. Once an anomaly is detected, the system immediately switches to the backup path and updates the node routing table. At the same time, the reinforcement learning algorithm is used to dynamically adjust the key update period according to the reward value of the network state to seek the optimal balance between security and performance. Finally, through the configuration distribution interface, the updated key-path mapping relationship is synchronized to each node to achieve real-time updates of the routing and encryption policies. The system continuously monitors the network operation status, collects data such as traffic and latency, and identifies potential threats through the clustering analysis algorithm to achieve real-time warning and adaptive optimization, and continuously improve the network security protection level.

[0028] S1015. For a data transmission request, dynamically select the optimal transmission path, obtain the corresponding encryption key from the key-path mapping relationship table, and use this key to encrypt the transmission data.

[0029] Obtain the topological structure and node information of the network transmission path, and construct a transmission path model according to the logical relationship between nodes and the physical link status. Generate a set of encryption keys through a key generation algorithm. The key length is determined according to the preset security level, and a random number generator is used to obtain the initial seed. Bind the generated encryption keys to the transmission path model to form a key-path mapping relationship table, which is stored in the security database. For different data transmission requests, dynamically select the optimal transmission path and obtain the corresponding encryption key from the key-path mapping relationship table. Use the obtained encryption key to encrypt the transmitted data to ensure the confidentiality of the data during transmission. During the data transmission process, monitor the network link quality and node status in real time to determine whether there are abnormal changes. If an abnormal change in the network environment is detected, trigger the path switching and key update mechanism, and dynamically adjust the transmission path and encryption key according to the change situation. Analyze the network environment changes and attack threat situations through machine learning algorithms, and dynamically adjust the key update period and path optimization strategy to achieve adaptive optimization. Synchronize the updated key-path mapping relationship to the network service configuration in real time to ensure the efficiency and security of encrypted communication and improve the overall protection level.

[0030] Specifically, first obtain the network topology structure, including 50 nodes and 100 links between them, and construct a transmission path model according to indicators such as the average delay between nodes being less than 10 ms and the packet loss rate being lower than 0.1%. Then use the SHA-256 algorithm to generate 256-bit encryption keys, and use a hardware random number generator to obtain a 128-bit initial seed. Next, bind the keys to the path model to form a hash table containing 1000 mapping relationships and store it. For each data transmission request, select the path with the minimum delay in the path model through the Dijkstra algorithm and obtain the corresponding encryption key. Use the AES-256 algorithm to encrypt the transmitted data with the selected key. During the transmission process, detect the link RTT and node CPU utilization every 100 ms. If the RTT exceeds 50 ms or the CPU utilization is higher than 80%, trigger path switching and update the encryption key through a key derivation function. At the same time, use the support vector machine algorithm to analyze 100 environmental change situations in the last hour, and dynamically adjust the key update period to 5 - 60 minutes and the delay weight coefficient in the path selection strategy. Finally, synchronize the updated 1000 key-path mapping relationships to the network service configuration, and control the average synchronization delay within 100 ms to ensure the real-time performance and security of encrypted communication.

[0031] S1016. Real-time monitor the data transmission process through a preset monitoring module, obtain the transmission behavior data, compare it with the preset abnormal behavior feature library, and trigger the protection plan update mechanism if there is an abnormality.

[0032] The behavior data during the data transmission process is obtained in real time through a preset monitoring module, and the obtained behavior data is compared with a pre-established abnormal behavior feature library to determine whether there is any abnormal behavior. If the comparison result indicates the existence of abnormal behavior, a protection scheme update mechanism is triggered. According to the type and severity of the abnormal behavior, the corresponding protection scheme is selected from the preset protection scheme library. The selected protection scheme is compared with the currently used protection scheme to determine whether an update is needed. If an update is needed, the selected protection scheme is used as the new current protection scheme to replace the original one. According to the updated protection scheme, the monitoring rules and abnormal judgment thresholds of the monitoring module are adjusted to improve the monitoring accuracy and response speed, and the data transmission process is continuously monitored in real time. If the monitoring results show that the abnormal behavior persists, the latest real-time threat data is obtained from the threat intelligence source through the API interface to update the local threat intelligence library. The newly obtained threat intelligence data is preprocessed, key features are extracted, converted into a format acceptable to the machine learning model, and input into the previously trained model for abnormal behavior detection and risk assessment. According to the abnormal behavior detection results and risk levels output by the model, combined with the preset protection rule library, an optimized new protection scheme is automatically generated and applied to the system to block or restrict suspicious behaviors. Continuously monitor the execution effect of the new protection scheme, dynamically adjust the scheme parameters according to the feedback results, and update the adjusted scheme to the network service configuration in real time and bind it to the transmission path. Apply the finally determined protection scheme to the entire life cycle of data transmission and storage, and ensure the continuous optimization of data security and effectively respond to changing network threats through dynamic encryption and real-time monitoring methods.

[0033] Specifically, the monitoring module acquires behavior data such as the source IP, destination IP, port, and protocol of data transmission per second, extracts the key feature vectors therefrom, calculates the Euclidean distance with thousands of rules in the abnormal behavior feature library. If the minimum distance is less than the preset threshold of 0.1, it is determined as abnormal. Once an abnormality is detected, the system immediately selects the optimal solution from the protection solution library containing 50 candidate solutions according to the type and risk score of the abnormal behavior using the decision tree algorithm. The new solution is compared item by item with the current solution. If more than 30% of the parameters are different, an update is triggered and the new solution is sent to replace the original configuration. At the same time, parameters such as the data sampling frequency, feature extraction algorithm, and abnormal determination threshold in the monitoring module are automatically adjusted according to the new solution to improve the monitoring performance. If the abnormality continues to occur for 3 consecutive cycles, the system obtains external threat intelligence in real time at 5-second intervals through the API interface and updates the local threat library. The newly added intelligence data is standardized and discretized, and converted into a sparse vector using One-Hot encoding, and then input into the pre-trained LightGBM model for abnormal detection and risk assessment to generate a confidence score. Combining the model results and the expert rule library, automatically make a decision to generate a targeted new protection solution, such as blocking an IP or restricting the number of sessions, and deploy it to the protection gateway in real time. The system continuously verifies the effectiveness of the new solution, optimizes it online based on the reinforcement learning algorithm, continuously improves the protection performance, and synchronizes it with the transmission link in real time. Finally, the optimized solution is applied to the entire data life cycle stage such as the source end, transmission channel, and destination end, constructs a national cipher SM4 dynamic encryption channel, and deploys an intelligent security agent for real-time monitoring to provide reliable guarantee for data security.

[0034] S1017. Select the corresponding solution from the preset protection solution library for update according to the type and severity of the abnormal behavior, and adjust the monitoring rules and abnormal judgment threshold of the monitoring module.

[0035] The specific steps are as follows: Based on the abnormal behavior data obtained by the monitoring module, determine the type and severity of the abnormal behavior, and select a protection plan that matches the abnormal behavior from the preset protection plan library. Compare the selected protection plan with the currently used protection plan, and determine the degree of difference between the two plans through a similarity calculation algorithm. If the degree of difference exceeds the preset threshold, trigger the protection plan update process. Extract the key parameters in the selected protection plan, including encryption algorithms, key lengths, transmission paths, etc., and generate an updated protection plan configuration file based on these parameters. Send the updated protection plan configuration file to the network service node, parse the new protection plan through the configuration file parsing module, and load it into all links of data transmission and storage. According to the updated protection plan, adjust the monitoring rules of the monitoring module, including the judgment conditions of abnormal behavior, data collection frequency, etc., to improve the accuracy and real-time performance of monitoring. Use machine learning algorithms to dynamically optimize the abnormal judgment threshold of the monitoring module. By analyzing historical abnormal behavior data, automatically learn and adjust the threshold parameters to improve the detection rate of abnormal behavior. During data transmission, collect network behavior data in real time, transmit it to the monitoring module for analysis, and through the updated monitoring rules and abnormal judgment threshold, achieve rapid identification and response to abnormal behavior. If it is detected that abnormal behavior persists, trigger the threat intelligence update mechanism, obtain the latest threat data through the API interface, and integrate it into the local threat intelligence library for optimizing the protection plan. According to the updated threat intelligence, re-evaluate the effectiveness of the current protection plan. If it is found that there are protection blind spots or weaknesses, automatically generate targeted patch programs to dynamically repair the protection plan to ensure that it can continuously cope with the latest security threats.

[0036] Specifically, when the monitoring module detects abnormal behavior during data transmission, such as the packet transmission frequency suddenly increasing to 1000 per second, far exceeding the normal range, it is determined as a DDoS attack with a high-risk severity level. The system automatically selects encryption scheme A for DDoS from the preset protection scheme library, compares it with the currently used scheme B, calculates the difference degree between the two through the cosine similarity algorithm as 0.7, exceeding the preset update threshold of 0.5, thus triggering the update of the protection scheme. The system extracts the key parameters of scheme A, upgrades the AES encryption algorithm to AES-256, increases the key length to 2048 bits, adjusts the transmission path to the P2P network, generates a new configuration file and distributes it to each node. At the same time, the abnormal judgment condition of the monitoring module is adjusted to that the packet frequency is greater than 500 per second and the duration exceeds 5 minutes, and the data collection frequency is increased to once per second. Through the support vector machine (SVM) algorithm, combined with the abnormal behavior data of the recent week, the abnormal judgment threshold is dynamically adjusted to 800 packets per second. During data transmission, network behavior data is transmitted to the monitoring module in real time. Through the updated rules and thresholds, DDoS anomalies are identified within 1 second and protection measures are initiated. Since the abnormal behavior has not stopped for 5 minutes, the system obtains the latest DDoS attack fingerprint library through the API interface, integrates it into the local threat intelligence library, re-evaluates the protection scheme, and finds that the current P2P transmission path still has the risk of being attacked. Therefore, it automatically generates a path optimization patch, switches the transmission path to the standby VPN dedicated line, further improves the protection ability, and finally effectively curbs the impact of the DDoS attack on the business.

[0037] S1018. If it is detected that the abnormal behavior persists, re-obtain the latest network security threat intelligence, repeat the above steps, generate a new dynamic protection scheme, and apply it to the entire process of data transmission to continuously optimize the data security protection measures.

[0038] Based on the monitoring results, determine whether there is continuous abnormal behavior. If so, trigger the subsequent steps; otherwise, continue monitoring. Obtain the latest real-time threat data from threat intelligence sources through the API interface and update the local threat intelligence database. Preprocess the newly obtained threat intelligence data, extract key features, and convert it into a format acceptable to the model. Input the preprocessed new data into the previously trained machine learning model for abnormal behavior detection and risk assessment. According to the abnormal behavior detection results and risk levels output by the model, determine whether a new protection plan needs to be generated. If the protection plan needs to be updated, based on the abnormal behavior characteristics and risk levels, combined with the preset protection rule library, automatically generate an optimized protection plan. Apply the newly generated protection plan to the system to block or restrict suspicious behaviors and continuously monitor the execution effect of the plan. According to the feedback results of the protection plan execution, dynamically adjust the plan parameters and optimize the data security protection measures. Apply the optimized protection plan to the entire life cycle of data transmission and storage to achieve continuous adaptive protection against network threats.

[0039] Specifically, through a preset monitoring module, continuously monitor the abnormal behaviors during the data transmission process. Adopt an abnormal detection algorithm that combines rules and machine learning, and compare the behavior data during the data transmission process with the data in the abnormal behavior feature library. If the similarity exceeds a threshold (such as 80%), it is determined as an abnormal behavior. When continuous abnormal behaviors are detected, the system automatically obtains the latest threat data such as malware, phishing websites, and botnets from threat intelligence sources such as VirusTotal through the API interface and updates the local threat intelligence database. Then, perform feature extraction and vectorization processing on the obtained threat data and convert it into a format suitable for input to the machine learning model. Input the processed new threat data into a pre-trained abnormal detection model (such as Support Vector Machine SVM or Random Forest) to perform abnormal detection and risk scoring on the current network behavior. If the abnormal probability exceeds 95% or the risk score is higher than 8 points (out of 10), trigger the protection plan update process. The system selects corresponding security protection measures (such as encryption algorithms, key lengths, transmission protocols, etc.) from the preset protection strategy library according to the abnormal behavior type and threat level, and automatically generates an updated data security protection plan. The new protection plan is applied to all links of data transmission to block and isolate the identified suspicious behaviors in real time, and continuously monitor the execution effect of the plan. According to the feedback results such as the occurrence of data security incidents and the protection success rate, use reinforcement learning algorithms (such as Q-Learning) to dynamically optimize and adjust the protection plan, and finally form a set of adaptive data security protection systems that can intelligently respond to constantly changing network security threats.

[0040] It should be noted that the above are only several specific embodiments of the present invention. Obviously, the present invention is not limited to the above embodiments and there can be many variations. All variations that can be directly derived or associated by those of ordinary skill in the art from the disclosed content of the present invention shall be considered as within the protection scope of the present invention.

Claims

1. A method for integrating an optimized network service and a dynamically generated protection scheme, characterized in that Including: Obtain threat intelligence data, determine whether the current network service supports a preset encryption protocol according to the threat intelligence data. If it supports, determine the current network service as a candidate network service. If it does not support, filter other network services; Extract the encryption protocol type and strength parameters of the candidate network service, and determine the target network service in combination with the threat level in the threat intelligence data; Generate an encryption key based on the encryption protocol type and strength parameters of the target network service; Bind the encryption key to the transmission path to form a protection scheme; Including: Obtain network topology information, construct a network transmission path model according to the network topology information. The network transmission path model includes multiple network nodes and links connecting the network nodes; Associate the encryption key with the network nodes and links in the network transmission path model to form a key-path mapping relationship; According to different data transmission requests, select the corresponding transmission path from the network transmission path model, and allocate the encryption key to the network nodes and links on the transmission path; Combine the encryption key, the transmission path, and the corresponding security configuration information into a protection scheme, and store the protection scheme in the configuration database; Monitor abnormal behaviors during the data transmission process, and update the protection scheme if abnormal behaviors are detected.

2. The method according to claim 1, wherein The obtaining of the threat intelligence data and determining whether the current network service supports a preset encryption protocol according to the threat intelligence data includes: Obtain multi-source threat intelligence data through an interface, integrate and clean the multi-source threat intelligence data to form a threat intelligence report in a unified format; Analyze the threat intelligence report, and extract network service information. The network service information at least includes the address, port, and protocol type of the network service; Compare the network service information with a preset encryption protocol list to determine whether the current network service supports the encryption protocols in the preset encryption protocol list. If the current network service supports at least one encryption protocol in the preset encryption protocol list, it is determined that the current network service supports the preset encryption protocol. Otherwise, it is determined that the current network service does not support the preset encryption protocol.

3. The method according to claim 1, characterized in that The extracting of the encryption protocol type and strength parameters of the candidate network service and determining the target network service in combination with the threat level in the threat intelligence data includes: Traverse the candidate network service list. For each candidate network service, extract the encryption protocol type supported by the candidate network service and the strength parameters corresponding to each encryption protocol; Extract threat level information from the threat intelligence data, and map the threat level information to a numerical threat level score according to a preset threat level classification standard; Construct a network service security evaluation model according to the encryption protocol type and strength parameters, and calculate the security score of each candidate network service using a preset evaluation algorithm; Combine the threat level score and the security score, and use a weighted calculation method to obtain the comprehensive security score of each candidate network service, and select the candidate network service with the highest comprehensive security score as the target network service.

4. The method according to claim 1, characterized in that, Generating an encryption key based on the encryption protocol type and strength parameter of the target network service, including: Selecting a corresponding key generation algorithm according to the encryption protocol type of the target network service. If the encryption protocol type is symmetric encryption, select the first key generation algorithm; if the encryption protocol type is asymmetric encryption, select the second key generation algorithm; Determining the key length according to the encryption protocol strength parameter of the target network service, and the key length is positively correlated with the encryption protocol strength parameter; Generating an initial random number through a hardware random number generator, and generating an initial key based on the initial random number and the key generation algorithm; Performing complexity detection on the initial key, determining whether the initial key meets the preset complexity requirement. If not, regenerate the initial key until the generated initial key meets the complexity requirement, and use the initial key that meets the complexity requirement as the encryption key.

5. The method according to claim 1, wherein Monitoring abnormal behaviors during data transmission, and updating the protection scheme if abnormal behaviors are detected, including: Obtaining data packets during data transmission through the method of bypass listening, parsing the data packets, and extracting data packet feature information; Comparing the data packet feature information with a preset abnormal behavior feature library to determine whether there are abnormal behaviors. If at least one data packet feature information matches the features in the abnormal behavior feature library, it is determined that there are abnormal behaviors; When abnormal behaviors are detected, triggering a protection scheme update mechanism, and selecting a new protection scheme from the protection scheme library according to the type and level of the abnormal behaviors; Sending the new protection scheme to the network device to replace the original protection scheme.

6. The method according to claim 5, wherein Selecting a new protection scheme from the protection scheme library according to the type and level of the abnormal behaviors, including: Determining the urgency of the protection scheme update according to the type and level of the abnormal behaviors; If the level of the abnormal behavior is a high-risk level, select the protection scheme with the fastest update speed; If the level of the abnormal behavior is a medium-risk level, balance between the update speed and security, and select a protection scheme with a relatively fast update speed and high security; If the level of the abnormal behavior is a low-risk level, select the protection scheme with the highest security. When updating the protection scheme, select a protection scheme with a specific protection effect for this type of abnormal behavior according to the type of the abnormal behavior. After updating the protection scheme, verify the new protection scheme to ensure that it can protect against the detected abnormal behaviors.

Images